only allow L1 access